RFC 2951
TELNET Authentication Using KEA and SKIPJACK
TELNET Authentication Using KEA and SKIPJACK 🎀
okay bestie, this is RFC 2951 and it's giving security protocol glow-up 💅✨
- Title: TELNET Authentication Using KEA and SKIPJACK
- Authors: R. Housley, T. Horting, and P. Yee (all at SPYRUS)
- Category: Informational 📚
- Date: September 2000
- Obsoletes / Updates: the title block doesn't list any RFCs that this one obsoletes or updates
Status of this Memo
this memo gives info to the Internet community 🌸 it does NOT set any Internet standard, and anyone can distribute it freely.
Copyright Notice
Copyright (C) The Internet Society (2000). All Rights Reserved. 🔒
Abstract
okay so the main idea is this 💖 the doc defines a way to authenticate TELNET using the Key Exchange Algorithm (KEA), and a way to encrypt the TELNET stream using SKIPJACK. there are two encryption modes, and one gives you data integrity while the other doesn't. the whole thing rides on the TELNET Authentication Option 🦋
1. Command Names and Codes ✨
here's the cheat sheet of every name and code, copied exactly 💅
AUTHENTICATION 37
Authentication Commands:
IS 0
SEND 1
REPLY 2
NAME 3
Authentication Types:
KEA_SJ 12
KEA_SJ_INTEG 13
Modifiers:
AUTH_WHO_MASK 1
AUTH_CLIENT_TO_SERVER 0
AUTH_SERVER_TO CLIENT 1
AUTH_HOW_MASK 2
AUTH_HOW_ONE_WAY 0
AUTH_HOW_MUTUAL 2
ENCRYPT_MASK 20
ENCRYPT_OFF 0
ENCRYPT_USING_TELOPT 4
ENCRYPT_AFTER_EXCHANGE 16
ENCRYPT_RESERVED 20
INI_CRED_FWD_MASK 8
INI_CRED_FWD_OFF 0
INI_CRED_FWD_ON 8
Sub-option Commands:
KEA_CERTA_RA 1
KEA_CERTB_RB_IVB_NONCEB 2
KEA_IVA_RESPONSEB_NONCEA 3
KEA_RESPONSEA 42. TELNET Security Extensions 🔐
okay real talk, TELNET by itself has zero concept of security 💀 without negotiated options it just passes characters back and forth between the two NVTs (the TELNET processes on each end). the most common use is remote terminal access on TCP port 23, and that usually means logging into a server with a username and password sent in the clear. the server never authenticates itself to you, which is so sus 🙈
the TELNET Authentication Option gives you four things 🎀
- User authentication: it can replace or add to the normal host password thing.
- Server authentication: usually paired with user authentication.
- Session parameter negotiation: especially the encryption key and its attributes.
- Session protection: mostly encrypting the data and the embedded command stream. the encryption algorithm can also give you data integrity.
so the two TELNET entities have to first agree they're willing to use the TELNET Authentication Option. once they agree, they can do sub-option negotiations to pick the authentication protocol and maybe the remote username for authorization checks. encryption gets negotiated together with the authentication type 🫶
the back-and-forth is an unbounded series of exchanges. the server proposes a preference-ordered list of the authentication types (mechanisms) it supports. for each one, it adds a modifier that says whether it wants the data encrypted. the client picks one mechanism from the list and replies with its choice plus the first set of authentication data that type needs. the client can ignore the encryption request and say so, but the server can also end the connection if the client refuses encryption 😤 then they keep going through however many rounds it takes to finish the authentication.
encryption starts right away once the Authentication Option is done 🌈
3. Use of Key Exchange Algorithm (KEA) 🦋
this part explains how KEA gets used for TELNET Authentication. KEA (working together with SKIPJACK) [4] gives you authentication and confidentiality. integrity can be provided too ✨
TELNET entities can use KEA for mutual authentication and to set up data encryption keys. it's a simple token format plus a set of exchanges, and that's it 💖
NonceA and NonceB are 64-bit bit strings. the client makes NonceA, the server makes NonceB, and the nonce value is picked randomly. the nonce gets sent in big endian form. encrypting the nonce uses the same mechanism the session will use, which the next section covers 🍓
Ra and Rb are 1024-bit strings, and they're defined by the KEA Algorithm [4].
IVa and IVb are 24-byte Initialization Vectors. each one is "THIS IS NOT LEAF" followed by 8 random bytes 🧚
CertA is the client's certificate and CertB is the server's. both are X.509 certificates [6] that contain KEA public keys [7]. the client must validate the server's certificate before using the KEA public key inside it. the server must validate the client's certificate before using the KEA public key inside that one too. no skipping the security check bestie 🔥
once the exchanges finish, both parties have a shared SKIPJACK key 👑 mutual authentication comes from checking the certificates used to set up the SKIPJACK encryption key, plus successfully using the derived SKIPJACK session key. to protect against active attacks, encryption kicks in only after authentication succeeds. there's no way to turn encryption off and then safely turn it back on. the only safe restart is repeating the whole authentication. if the user doesn't want encryption, they may turn it off after the session is set up 🙈
3.1. SKIPJACK Modes 💜
there are two different modes for encrypting TELNET streams. one gives integrity and the other doesn't. TELNET usually works one character at a time, so SKIPJACK with stream integrity needs to send 4 bytes for every TELNET data byte. the simpler SKIPJACK mode without integrity only needs to send one byte for every TELNET data byte 🫶
the crypto mode for SKIPJACK with stream integrity is Cipher Feedback on 32 bits of data (CFB-32). the mode for SKIPJACK is Cipher Feedback on 8 bits of data (CFB-8).
3.1.1. SKIPJACK without stream integrity 🌸
this is the first and simplest mode. it uses SKIPJACK CFB-8 and gives you no stream integrity, which is fine if that's all you need.
for SKIPJACK without stream integrity, the two-octet authentication type pair is KEA_SJ AUTH_CLIENT_TO_SERVER | AUTH_HOW_MUTUAL | ENCRYPT_AFTER_EXCHANGE | INI_CRED_FWD_OFF. this tells you SKIPJACK without the integrity mechanism gets used for mutual authentication and TELNET stream encryption. Figure 1 shows the KEA authentication flow followed by SKIPJACK without stream integrity 📈
---------------------------------------------------------------------
Client (Party A) Server (Party B)
<-- IAC DO AUTHENTICATION
IAC WILL AUTHENTICATION -->
<-- IAC SB AUTHENTICATION SEND
<list of authentication options>
IAC SE
IAC SB AUTHENTICATION
NAME <user name> -->
IAC SB AUTHENTICATION IS
KEA_SJ
AUTH_CLIENT_TO_SERVER |
AUTH_HOW_MUTUAL |
ENCRYPT_AFTER_EXCHANGE |
INI_CRED_FWD_OFF
KEA_CERTA_RA
CertA||Ra IAC SE -->
<-- IAC SB AUTHENTICATION REPLY
KEA_SJ
AUTH_CLIENT_TO_SERVER |
AUTH_HOW_MUTUAL |
ENCRYPT_AFTER_EXCHANGE |
INI_CRED_FWD_OFF
IVA_RESPONSEB_NONCEA
KEA_CERTB_RB_IVB_NONCEB
CertB||Rb||IVb||
Encrypt( NonceB )
IAC SE
IAC SB AUTHENTICATION IS
KEA_SJ
AUTH_CLIENT_TO_SERVER |
AUTH_HOW_MUTUAL |
ENCRYPT_AFTER_EXCHANGE |
INI_CRED_FWD_OFF
KEA_IVA_RESPONSEB_NONCEA
IVa||Encrypt( (NonceB XOR 0x0C12)||NonceA )
IAC SE -->
Client (Party A) Server (Party B)
<client begins encryption>
<-- IAC SB AUTHENTICATION REPLY
KEA_SJ
AUTH_CLIENT_TO_SERVER |
AUTH_HOW_MUTUAL |
ENCRYPT_AFTER_EXCHANGE |
INI_CRED_FWD_OFF
KEA_RESPONSEA
Encrypt( NonceA XOR 0x0C12 )
IAC SE
<server begins encryption>
---------------------------------------------------------------------
Figure 1.3.1.2. SKIPJACK with stream integrity 🔥
this one is the fancier, more complicated mode. it uses the SHA-1 [3] one-way hash function to protect the integrity of the encryption stream, like this 🧠
Set H0 to be the SHA-1 hash of a zero-length string.
Cn is the nth character in the TELNET stream.
Hn = SHA-1( Hn-1||Cn ), where Hn is the hash value
associated with the nth character in the stream.
ICVn is set to the three most significant bytes of Hn.
Transmit Encrypt( Cn||ICVn ).the ciphertext that gets sent is the SKIPJACK CFB-32 encryption of ( Cn||ICVn ). the receiving end reverses everything: it decrypts the ciphertext, splits out Cn and ICVn, recalculates Hn and ICVn, and then compares the received ICVn to the recalculated one. if they match, integrity is confirmed and Cn can be processed normally as part of the TELNET stream. if they don't match, something's wrong, whether that's active tampering or lost cryptographic sync. either way, the only option is to drop the TELNET connection and start over 😭
for SKIPJACK with stream integrity, the two-octet authentication type pair is KEA_SJ_INTEG AUTH_CLIENT_TO_SERVER | AUTH_HOW_MUTUAL | ENCRYPT_AFTER_EXCHANGE | INI_CRED_FWD_OFF. this tells you the KEA SKIPJACK mode with integrity gets used for mutual authentication and TELNET stream encryption. Figure 2 shows the authentication flow for KEA SKIPJACK with stream integrity 🦋
---------------------------------------------------------------------
Client (Party A) Server (Party B)
<-- IAC DO AUTHENTICATION
IAC WILL AUTHENTICATION -->
<-- IAC SB AUTHENTICATION SEND
<list of authentication options>
IAC SE
IAC SB AUTHENTICATION
NAME <user name> -->
IAC SB AUTHENTICATION IS
KEA_SJ_INTEG
AUTH_CLIENT_TO_SERVER |
AUTH_HOW_MUTUAL |
ENCRYPT_AFTER_EXCHANGE |
INI_CRED_FWD_OFF
KEA_CERTA_RA
CertA||Ra IAC SE -->
<-- IAC SB AUTHENTICATION REPLY
KEA_SJ_INTEG
AUTH_CLIENT_TO_SERVER |
AUTH_HOW_MUTUAL |
ENCRYPT_AFTER_EXCHANGE |
INI_CRED_FWD_OFF
IVA_RESPONSEB_NONCEA
KEA_CERTB_RB_IVB_NONCEB
CertB||Rb||IVb||
Encrypt( NonceB )
IAC SE
IAC SB AUTHENTICATION IS
KEA_SJ_INTEG
AUTH_CLIENT_TO_SERVER |
AUTH_HOW_MUTUAL |
ENCRYPT_AFTER_EXCHANGE |
INI_CRED_FWD_OFF
KEA_IVA_RESPONSEB_NONCEA
IVa||Encrypt( (NonceB XOR 0x0D12)||NonceA )
IAC SE -->
Client (Party A) Server (Party B)
<client begins encryption>
<-- IAC SB AUTHENTICATION REPLY
KEA_SJ_INTEG
AUTH_CLIENT_TO_SERVER |
AUTH_HOW_MUTUAL |
ENCRYPT_AFTER_EXCHANGE |
INI_CRED_FWD_OFF
KEA_RESPONSEA
Encrypt( NonceA XOR 0x0D12 )
IAC SE
<server begins encryption>
---------------------------------------------------------------------
Figure 24.0. Security Considerations 🔐
Okay bestie, this entire memo is about security mechanisms, so this section is literally the main event 💅. For KEA to actually give you the authentication we've been talking about, the implementation has to protect the private key from being disclosed. The SKIPJACK keys need that same protection, no exceptions 🗝️.
Implementations must randomly generate KEA private keys, initialization vectors (IVs), and nonces. Using inadequate pseudo-random number generators (PRNGs) to make cryptographic keys can end up giving you little or no security 💀. An attacker may find it way easier to recreate the PRNG environment that made the keys and then search that small set of possibilities, instead of brute forcing the whole key space. Generating quality random numbers is genuinely hard, ngl. [8] offers important guidance here, and Appendix 3 of [9] (that's FIPS Pub 186 for the record) gives you one quality PRNG technique 🎀.
Here's the iconic part: by tying the turning-on of encryption to a successful authentication, you get protection against an active attacker 🛡️. If encryption were enabled as its own separate negotiation, there would be a window of vulnerability from the moment authentication completes, all the way up to and including the negotiation that turns encryption on. The only safe way to restart encryption, if it has been turned off, is to repeat the entire authentication process. No shortcuts, periodt 🙅♀️.
5. IANA Considerations 🌸
The authentication types KEA_SJ and KEA_SJ_INTEG, along with their associated suboption values, are registered with IANA ✨. Any suboption values used to extend the protocol as described in this document must be registered with IANA before use. IANA has been told not to issue new suboption values unless documentation of their use has been submitted first 📋.
6.0. Acknowledgements 🫶
We would like to thank William Nace for support during implementation of this specification. Shoutout to William, he's a real one 🌟.
7.0. References 📚
Here's the full reference list, every single one of them:
[1] Postel, J. and J. Reynolds, "TELNET Protocol Specification", ASTD
8, RFC 854, May 1983.
[2] Ts'o, T. and J. Altman, "Telnet Authentication Option", RFC 2941,
September 2000.
[3] Secure Hash Standard. FIPS Pub 180-1. April 17, 1995.
[4] "SKIPJACK and KEA Algorithm Specification", Version 2.0, May 29,
1998. Available from http://csrc.nist.gov/encryption/skipjack-
kea.htm
[5] Postel, J. and J. Reynolds, "TELNET Option Specifications", STD
8, RFC 855, May 1983.
[6] Housley, R., Ford, W., Polk, W. and D. Solo, "Internet X.509
Public Key Infrastructure: X.509 Certificate and CRL Profile",
RFC 2459, January 1999.
[7] Housley, R. and W. Polk, "Internet X.509 Public Key
Infrastructure - Representation of Key Exchange Algorithm (KEA)
Keys in Internet X.509 Public Key Infrastructure Certificates",
RFC 2528, March 1999.
[8] Eastlake, D., Crocker, S. and J. Schiller, "Randomness
Recommendations for Security", RFC 1750, December 1994.
[9) National Institute of Standards and Technology. FIPS Pub 186:
Digital Signature Standard. 19 May 1994.8.0. Authors' Addresses 💌
Meet the squad who wrote this, all from SPYRUS 🧚:
Russell Housley
SPYRUS
381 Elden Street, Suite 1120
Herndon, VA 20170
USA
EMail: housley@spyrus.comTodd Horting
SPYRUS
381 Elden Street, Suite 1120
Herndon, VA 20170
USA
EMail: thorting@spyrus.comPeter Yee
SPYRUS
5303 Betsy Ross Drive
Santa Clara, CA 95054
USA
EMail: yee@spyrus.com9. Full Copyright Statement ⭐
The legal bits are next, and I'm keeping them word for word because they matter 📜.
Copyright (C) The Internet Society (2000). All Rights Reserved.
This document and translations of it may be copied and furnished to
others, and derivative works that comment on or otherwise explain it
or assist in its implementation may be prepared, copied, published
and distributed, in whole or in part, without restriction of any
kind, provided that the above copyright notice and this paragraph are
included on all such copies and derivative works. However, this
document itself may not be modified in any way, such as by removing
the copyright notice or references to the Internet Society or other
Internet organizations, except as needed for the purpose of
developing Internet standards in which case the procedures for
copyrights defined in the Internet Standards process must be
followed, or as required to translate it into languages other than
English.
The limited permissions granted above are perpetual and will not be
revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided on an
"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.Acknowledgement 🎀
Funding for the RFC Editor function is currently provided by the Internet Society. Thank you, Internet Society, you're the real MVP 👑.
📦 where this page comes from
- ietf: rfc2951 2000-09
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms